@keystrokehq/shopify 0.0.11 → 0.0.15

package/dist/integration-vSl3XHTG.mjs

@@ -1,340 +0,0 @@
-import { CredentialSet, Operation } from "@keystrokehq/core";
-import { z } from "zod";
-import { createHmac, timingSafeEqual } from "node:crypto";
-
-//#region ../../packages/integration-authoring/dist/official/runtime.mjs
-const REGISTRY_KEY = "__ks_official_integration_metadata_registry";
-function getRegistry() {
-	const globalStore = globalThis;
-	if (!globalStore[REGISTRY_KEY]) globalStore[REGISTRY_KEY] = /* @__PURE__ */ new WeakMap();
-	return globalStore[REGISTRY_KEY];
-}
-function registerOfficialOperation(operation, metadata) {
-	getRegistry().set(operation, Object.freeze({ ...metadata }));
-}
-
-//#endregion
-//#region ../../packages/integration-authoring/dist/official/index.mjs
-const OFFICIAL_CREDENTIAL_SET_ID_PREFIX = "keystroke:";
-function officialCredentialSetId(id) {
-	return `${OFFICIAL_CREDENTIAL_SET_ID_PREFIX}${id}`;
-}
-function stripOfficialCredentialSetIdPrefix(id) {
-	return id.startsWith(OFFICIAL_CREDENTIAL_SET_ID_PREFIX) ? id.slice(10) : id;
-}
-/**
-* Creates a factory for Keystroke-official integration operations.
-*
-* It keeps the same flat `run(input, credentials)` ergonomics as the generic
-* operation factory, while registering official metadata for builder/runtime
-* operation metadata.
-*/
-function createOfficialOperationFactory(credentialSet) {
-	const integrationId = stripOfficialCredentialSetIdPrefix(credentialSet.id);
-	return (config) => {
-		const wrappedRun = async (input, ctx) => {
-			const creds = ctx.credentials[credentialSet.id];
-			return config.run(input, creds);
-		};
-		const operation = new Operation({
-			id: config.id,
-			name: config.name,
-			description: config.description,
-			input: config.input,
-			output: config.output,
-			credentialSets: [credentialSet],
-			...config.tags !== void 0 ? { tags: config.tags } : {},
-			...config.needsApproval !== void 0 ? { needsApproval: config.needsApproval } : {},
-			...config.requiredOAuthScopes !== void 0 ? { requiredOAuthScopes: config.requiredOAuthScopes } : {},
-			...config.retries !== void 0 ? { retries: config.retries } : {},
-			...config.timeout !== void 0 ? { timeout: config.timeout } : {},
-			...config.maxDurationMs !== void 0 ? { maxDurationMs: config.maxDurationMs } : {},
-			run: wrappedRun
-		});
-		registerOfficialOperation(operation, { integrationId });
-		return operation;
-	};
-}
-/**
-* Creates an official integration bundle from a single config object.
-*
-* - Creates the public `CredentialSet` internally.
-* - Accepts optional `internal` fields for Keystroke-owned platform credentials.
-*/
-function defineOfficialIntegration(config) {
-	const internalCredentialSets = config.internal ?? {};
-	const allInternalCredentialSets = [
-		...internalCredentialSets.providerApp ? [internalCredentialSets.providerApp] : [],
-		...internalCredentialSets.providerAppVariants ?? [],
-		...internalCredentialSets.webhookVerification ? [internalCredentialSets.webhookVerification] : [],
-		...internalCredentialSets.other ?? []
-	];
-	const credentialSet = new CredentialSet({
-		id: config.id,
-		name: config.name,
-		description: config.description,
-		auth: config.auth,
-		...config.connections ? { connections: config.connections } : {},
-		...config.proxy ? { proxy: config.proxy } : {},
-		...config.needsRawSecret === true ? { needsRawSecret: true } : {}
-	});
-	return Object.freeze({
-		integration: {
-			id: config.id,
-			name: config.name,
-			...config.description !== void 0 ? { description: config.description } : {},
-			auth: config.auth,
-			...config.proxy ? { proxy: config.proxy } : {},
-			...config.needsRawSecret === true ? { needsRawSecret: true } : {},
-			...config.connections ? { connections: config.connections } : {}
-		},
-		credentialSet,
-		internalCredentialSets,
-		allInternalCredentialSets
-	});
-}
-
-//#endregion
-//#region src/_official/provider-app.ts
-const shopifyAppCredentialSet = new CredentialSet({
-	id: officialCredentialSetId("shopify-app"),
-	exposure: "platform-only",
-	name: "Shopify App",
-	auth: z.object({
-		clientId: z.string(),
-		clientSecret: z.string(),
-		webhookSecret: z.string()
-	})
-});
-const shopifyOfficialProviderSeed = {
-	provider: "shopify",
-	appRef: "shopify-platform",
-	displayName: "Shopify Platform",
-	credentialSetName: "Keystroke Shopify Platform App",
-	envShape: {
-		KEYSTROKE_OFFICIAL_SHOPIFY_APP_ID: z.string().optional(),
-		KEYSTROKE_OFFICIAL_SHOPIFY_CLIENT_ID: z.string().optional(),
-		KEYSTROKE_OFFICIAL_SHOPIFY_CLIENT_SECRET: z.string().optional(),
-		KEYSTROKE_OFFICIAL_SHOPIFY_WEBHOOK_SECRET: z.string().optional()
-	},
-	requiredEnvKeys: [
-		"KEYSTROKE_OFFICIAL_SHOPIFY_APP_ID",
-		"KEYSTROKE_OFFICIAL_SHOPIFY_CLIENT_ID",
-		"KEYSTROKE_OFFICIAL_SHOPIFY_CLIENT_SECRET",
-		"KEYSTROKE_OFFICIAL_SHOPIFY_WEBHOOK_SECRET"
-	],
-	externalAppIdEnvKey: "KEYSTROKE_OFFICIAL_SHOPIFY_APP_ID",
-	buildCredentials: (env) => ({
-		clientId: env.KEYSTROKE_OFFICIAL_SHOPIFY_CLIENT_ID,
-		clientSecret: env.KEYSTROKE_OFFICIAL_SHOPIFY_CLIENT_SECRET,
-		webhookSecret: env.KEYSTROKE_OFFICIAL_SHOPIFY_WEBHOOK_SECRET
-	})
-};
-
-//#endregion
-//#region ../../packages/credential-connection/dist/defaults-YE9AvLIc.mjs
-/**
-* Shared OAuth 2.0 token-response plumbing.
-*
-* `parseOAuthTokenResponse` handles the two common wire formats (JSON and
-* form-urlencoded, the latter used by GitHub unless you explicitly ask for
-* JSON). `normalizeOAuthTokens` pulls the standard fields out of the parsed
-* body in both the flat form and Slack's nested `authed_user.access_token`
-* form. These helpers are exposed so integration authors overriding
-* `exchangeCode` / `refreshToken` do not have to re-implement them.
-*/
-var TokenExchangeError = class extends Error {
-	httpStatus;
-	constructor(httpStatus) {
-		super(`Token exchange failed: HTTP ${httpStatus}`);
-		this.name = "TokenExchangeError";
-		this.httpStatus = httpStatus;
-	}
-};
-async function parseOAuthTokenResponse(response) {
-	const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-	if (contentType.includes("application/json")) return await response.json();
-	const text = await response.text();
-	if (!text.trim()) return {};
-	if (contentType.includes("application/x-www-form-urlencoded") || text.includes("=")) {
-		const params = new URLSearchParams(text);
-		return Object.fromEntries(params.entries());
-	}
-	throw new Error(`Unsupported OAuth token response content type: ${contentType || "unknown"}`);
-}
-function normalizeOAuthTokens(tokenData) {
-	const authedUser = tokenData.authed_user;
-	const rawAccessToken = tokenData.access_token ?? authedUser?.access_token;
-	const rawRefreshToken = tokenData.refresh_token;
-	const rawExpiresIn = tokenData.expires_in;
-	const rawInstanceUrl = tokenData.instance_url;
-	return {
-		accessToken: typeof rawAccessToken === "string" ? rawAccessToken : void 0,
-		refreshToken: typeof rawRefreshToken === "string" ? rawRefreshToken : void 0,
-		expiresIn: typeof rawExpiresIn === "number" ? rawExpiresIn : typeof rawExpiresIn === "string" ? Number(rawExpiresIn) || void 0 : void 0,
-		instanceUrl: typeof rawInstanceUrl === "string" ? rawInstanceUrl : void 0
-	};
-}
-
-//#endregion
-//#region src/oauth-connection.ts
-/**
-* Shopify OAuth connection configuration.
-*
-* Shopify's OAuth flow is per-shop: every handshake is scoped to a specific
-* `{shop}.myshopify.com` domain that the user supplies up front. That shop
-* domain shows up in three places that make Shopify different from a plain
-* OAuth 2.0 integration:
-*
-*  - `buildAuthUrl` must point at the shop-specific authorize endpoint at
-*    `https://{shop}.myshopify.com/admin/oauth/authorize`. The shop domain is
-*    threaded in from the initiate-connection request via `initiateInput`.
-*  - `exchangeCode` verifies the Shopify HMAC signature on the callback query
-*    string before trusting any of it, and POSTs to the same shop-specific
-*    token endpoint. HMAC verification uses `timingSafeEqual` to avoid leaking
-*    bytes through timing side channels.
-*  - `refreshToken` reads the shop domain out of `oauthClient.metadata` (set
-*    during the initial exchange) so proactive refreshes still target the
-*    right store, and the `vault` mapping promotes the shop domain into
-*    `SHOPIFY_STORE_DOMAIN` so the vault has both the access token and the
-*    store it belongs to.
-*
-* Shopify responds with JSON, so we reuse `parseOAuthTokenResponse` +
-* `normalizeOAuthTokens` from `@keystrokehq/credential-connection` to avoid reimplementing
-* the token-response plumbing.
-*/
-function normalizeShopifyShopDomain(raw) {
-	const trimmed = raw?.trim().toLowerCase();
-	if (!trimmed) throw new Error("Shopify requires a store domain.");
-	const normalized = trimmed.endsWith(".myshopify.com") ? trimmed : `${trimmed}.myshopify.com`;
-	if (!/^[a-z0-9][a-z0-9-]*\.myshopify\.com$/i.test(normalized)) throw new Error("Invalid Shopify store domain.");
-	return normalized;
-}
-function verifyShopifyCallbackHmac(queryParams, clientSecret) {
-	const receivedHmac = queryParams.hmac;
-	if (!receivedHmac) return false;
-	const canonical = Object.entries(queryParams).filter(([key]) => key !== "hmac" && key !== "signature").sort(([left], [right]) => left.localeCompare(right)).map(([key, value]) => `${key}=${value}`).join("&");
-	const expected = createHmac("sha256", clientSecret).update(canonical).digest("hex");
-	const received = Buffer.from(receivedHmac, "utf8");
-	const expectedBuffer = Buffer.from(expected, "utf8");
-	if (received.length !== expectedBuffer.length) return false;
-	return timingSafeEqual(received, expectedBuffer);
-}
-function resolveShopifyTokenUrl(shopDomain) {
-	return `https://${shopDomain}/admin/oauth/access_token`;
-}
-async function shopifyTokenPost(shopDomain, body, missingTokenError) {
-	const response = await fetch(resolveShopifyTokenUrl(shopDomain), {
-		method: "POST",
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(body)
-	});
-	if (!response.ok) throw new TokenExchangeError(response.status);
-	const raw = await parseOAuthTokenResponse(response);
-	raw._shopifyShopDomain = shopDomain;
-	const { accessToken, refreshToken, expiresIn } = normalizeOAuthTokens(raw);
-	if (!accessToken) throw new Error(missingTokenError);
-	return {
-		accessToken,
-		refreshToken,
-		expiresIn,
-		raw
-	};
-}
-const shopifyOAuthConnection = {
-	kind: "oauth",
-	tokenType: "refreshable",
-	authUrl: "https://{shop}.myshopify.com/admin/oauth/authorize",
-	tokenUrl: "https://{shop}.myshopify.com/admin/oauth/access_token",
-	revokeUrl: null,
-	scopes: [
-		"read_products",
-		"write_products",
-		"read_orders",
-		"write_orders",
-		"read_customers",
-		"write_customers",
-		"read_inventory",
-		"write_inventory",
-		"read_locations",
-		"read_fulfillments",
-		"write_fulfillments",
-		"read_content",
-		"write_content",
-		"read_webhooks",
-		"write_webhooks"
-	],
-	vault: {
-		accessToken: "SHOPIFY_ACCESS_TOKEN",
-		raw: { SHOPIFY_STORE_DOMAIN: "_shopifyShopDomain" }
-	},
-	buildAuthUrl({ oauthClient, redirectUri, state, connection, initiateInput, requestedScopes }) {
-		const rawShopDomain = initiateInput?.shopDomain;
-		if (typeof rawShopDomain !== "string") throw new Error("Shopify requires a store domain.");
-		const scopes = requestedScopes ?? connection.scopes;
-		const shopDomain = normalizeShopifyShopDomain(rawShopDomain);
-		const url = new URL(`https://${shopDomain}/admin/oauth/authorize`);
-		url.searchParams.set("client_id", oauthClient.clientId);
-		url.searchParams.set("scope", scopes.join(","));
-		url.searchParams.set("redirect_uri", redirectUri);
-		url.searchParams.set("state", state);
-		return url.toString();
-	},
-	async exchangeCode({ oauthClient, code, queryParams }) {
-		if (!code) throw new Error("Missing authorization code");
-		const shopDomain = normalizeShopifyShopDomain(queryParams.shop);
-		if (!verifyShopifyCallbackHmac(queryParams, oauthClient.clientSecret)) throw new Error("Invalid Shopify OAuth callback signature");
-		return shopifyTokenPost(shopDomain, {
-			client_id: oauthClient.clientId,
-			client_secret: oauthClient.clientSecret,
-			code
-		}, "No access token in Shopify response");
-	},
-	async refreshToken({ oauthClient, refreshToken }) {
-		const rawShopDomain = oauthClient.metadata?.shopDomain;
-		if (typeof rawShopDomain !== "string") throw new Error("Missing Shopify store domain for token refresh.");
-		return shopifyTokenPost(normalizeShopifyShopDomain(rawShopDomain), {
-			grant_type: "refresh_token",
-			refresh_token: refreshToken,
-			client_id: oauthClient.clientId,
-			client_secret: oauthClient.clientSecret
-		}, "No access token in Shopify refresh response");
-	},
-	extractInstallationInfo({ tokenResult }) {
-		const shopDomain = typeof tokenResult.raw._shopifyShopDomain === "string" ? tokenResult.raw._shopifyShopDomain : void 0;
-		return {
-			externalInstallationId: shopDomain,
-			externalWorkspaceId: shopDomain,
-			metadata: shopDomain ? { shopDomain } : void 0
-		};
-	}
-};
-
-//#endregion
-//#region src/integration.ts
-const shopifyStoreDomainSchema = z.string().min(1).regex(/^[a-z0-9][a-z0-9-]*\.myshopify\.com$/i, "Shopify store domain must look like \"example.myshopify.com\".");
-const shopifyAuthSchema = z.object({
-	SHOPIFY_STORE_DOMAIN: shopifyStoreDomainSchema,
-	SHOPIFY_ACCESS_TOKEN: z.string().min(1)
-});
-const shopifyOfficialIntegration = {
-	id: "shopify",
-	name: "Shopify",
-	description: "Shopify Admin API — stores, products, orders, customers, and webhooks",
-	auth: shopifyAuthSchema,
-	connections: [{
-		id: "oauth",
-		...shopifyOAuthConnection
-	}]
-};
-const shopifyBundle = defineOfficialIntegration({
-	...shopifyOfficialIntegration,
-	internal: { providerApp: shopifyAppCredentialSet }
-});
-const shopify = shopifyBundle.credentialSet;
-
-//#endregion
-export { shopifyAppCredentialSet as a, shopifyStoreDomainSchema as i, shopifyBundle as n, shopifyOfficialProviderSeed as o, shopifyOfficialIntegration as r, createOfficialOperationFactory as s, shopify as t };